Tuesday, February 11, 2025
HomeRansomwareRyuk Ransomware Operators Employ Powershell Commands to Deploy Ransomware

Ryuk Ransomware Operators Employ Powershell Commands to Deploy Ransomware

Published on

SIEM as a Service

Follow Us on Google News

Recently, cybersecurity experts have claimed that the operators of Ryuk Ransomware are targeting severe infrastructures to extort high ransom from their victims.

In 2018, the Ryuk ransomware was spotted for the first time, and the security researchers claim that the Ryuk procured and developed by its operators from the Hermes ransomware’s source code. 

As last year one of the largest health care organizations that has more than 90,000 employees, 400 hospitals, behavioral health centers, outpatient clinics in the U.S. and U.K. have been attacked by the operators of Ryuk Ransomware.

By force, the organization had to covey all their patients to other hospitals and health centers, as the attackers managed to gain access to their internal IT network and shut down all the internal computer systems of this organization in the US.

However, in the victim list of Ryuk ransomware, there are not only health organizations, even there are other infrastructures as well, and here they are:-

  • Several oil and gas companies.
  • A U.S. agency.
  • A large engineering and construction services firm.
  • City and county government.
  • A financial software provider.
  • A food and drink manufacturer.
  • A newspaper.

But, later, the FBI publicly issued a warning about the Ryuk ransomware operators in June 2020, in which they claimed that the operators of Ryuk ransomware were also targeting educational institutes like K-12 institutes.

New tactics

As initial droppers, the operators of Ryuk ransomware have used the following malware:-

But, they have now adopted new methods and tactics, “PowerShell commands” by encoding this, they do the following things:-

  • Download the first payload.
  • Disable security tools.
  • Stop data backups.
  • Scan the network.

Apart from these things, to deploy the ransomware on the infected system, they also exploit the Windows Management Instrumentation (WMIC) and BitsAdmin. 

The operators of Ryuk ransomware designed this new strategy form to empower the ransomware to remain hidden for a longer time on the infected networks without any detection.

Hits the Government Systems

By using the new strategy form and tools, the operators of Ryuk ransomware have also targeted the government systems, and during their attack, they managed to encrypt near about 2,000 internal systems and critical services.

While the experts explain that to execute this attack the operators of Ryuk have first gain access to an account of a domain administrator whose passwords were saved in a group policy.

Here, to scan the network and disable the security tools, the attackers used PowerShell; after that to copy the Ryuk to additional hosts with privileged account credentials they exploited the Windows Management Instrumentation (WMIC), PowerShell, and BitsAdmin.

Recommendations

Moreover, the U.S. federal government have suggested the companies few recommendations to combat these threats, and here they are mentioned below:-

  • Perform regular backups.
  • Risk analysis to identify all the potential issues.
  • Proper staff training.
  • Keep the systems updated with the latest updates and security patches.
  • Application whitelisting to keep track of all the approved applications.
  • Incident response to identifying and eliminate cyberattacks.
  • Business Continuity.
  • Penetration Testing.

Cybersecurity analysts have ensured that by following the above-mentioned recommendations the companies and organizations will be able to protect their users from cyber attacks like this.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

12,000+ KerioControl Firewalls Exposed to 1-Click RCE Attack

Cybersecurity researchers caution that over 12,000 instances of GFI KerioControl firewalls remain unpatched and...

Apple iOS 0-day Vulnerability Exploited Wild in Extremely Sophisticated Attack

Apple has released emergency security updates to address a zero-day vulnerability, CVE-2025-24200, that has...

SHA256 Hash Calculation from Data Chunks

The SHA256 algorithm, a cryptographic hash function, is widely used for securing data integrity...

New Report of of 1M+ Malware Samples Show Application Layer Abused for Stealthy C2

A recent analysis of over one million malware samples by Picus Security has revealed...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

Ransomware Payments Plunge 35% as More Victims Refuse to Pay

In a significant shift within the ransomware landscape, global ransom payments plummeted by 35%...

NetSupport RAT Grant Attackers Full Access to Victims Systems

The eSentire Threat Response Unit (TRU) has reported a significant rise in incidents involving...

Cisco Data Breach – Ransomware Group Allegedly Breached Internal Network

Sensitive credentials from Cisco's internal network and domain infrastructure were reportedly made public due...